Zscaler Zero Trust Exchange

OCI · DOCKER.IO/ZSCALER/ZSCALER-MCP-SERVER:LATEST · 2 COMPONENTS · SCANNED AUG 3

Manage Zscaler Zero Trust Exchange via 280+ tools — ZPA, ZIA, ZDX, ZCC, EASM, and more.

Available components

oci · docker.io/zscaler/zscaler-mcp-server:latest 38 pypi · zscaler-mcp 10

−4 this week 38 38 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security0

Malware scan not yet available for this package.Unverified
CVE data not yet available for this package.Unverified
Install-script risk not yet assessed.Unverified
Dependency-health data not yet available.Unverified

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 6 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability82

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 15189 tokens (~59/item across 254 items; 254 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage71

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
0% of tool parameters carry a description.Fail
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 2 categories

Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

oci · docker.io/zscaler/zscaler-mcp-server:latest

Claude Codex opencode Hermes Other

# add to Claude Code

claude mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest

# add to Codex CLI

codex mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zscaler-zscaler-mcp-server": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ],
      "enabled": true
    }
  }
}

# ~/.hermes/config.yaml

mcp_servers:
  zscaler-zscaler-mcp-server:
    command: "docker"
    args: ["run", "--rm", "-i", "docker.io/zscaler/zscaler-mcp-server:latest"]

// mcp.json

{
  "mcpServers": {
    "zscaler-zscaler-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

31 Jul 26 −4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 +31
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: good functional
26 Jul 26 11

First indexed and scored.
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed oci/docker.io/zscaler/zscaler-mcp-server:latest

Provenance none

Ecosystem: oci · Outcome: none

Reason: no_attestation

MCP tools — 254 exposed · ~26,215 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

zia_url_lookup ~103

Look up the URL category classifications for a list of URLs/domains.

Input Output Examples

Name	Type	Req	Description
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
urls	array	yes	—

No output schema declared.

No examples provided.

zid_get_group ~28

Get one ZIdentity group by ID. Read-only.

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—

No output schema declared.

No examples provided.

zid_get_group_users ~141

List the users that belong to a ZIdentity group, by group ID. Read-only. Returns lean user summaries (id, login name, display name, primary email) for each member of the group.

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
limit	—	—	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_get_group_users_by_name ~143

List the users in a ZIdentity group resolved by group name. Read-only. Resolves the group by case-insensitive partial name first, then returns the lean user summaries for the first matching group's members.

Input Output Examples

Name	Type	Req	Description
limit	—	—	—
name	string	yes	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_get_user ~28

Get one ZIdentity user by ID. Read-only.

Input Output Examples

Name	Type	Req	Description
user_id	string	yes	—

No output schema declared.

No examples provided.

zid_get_user_groups ~144

List the groups a ZIdentity user belongs to, by user ID. Read-only. Returns lean group summaries (id, name, description, dynamic flag, source IdP) for each of the user's group memberships.

Input Output Examples

Name	Type	Req	Description
limit	—	—	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
user_id	string	yes	—

No output schema declared.

No examples provided.

zid_get_user_groups_by_name ~158

List a ZIdentity user's group memberships, resolving the user by name. Read-only. Resolves the user by case-insensitive partial match (email when '@' present, else login then display name), then returns the lean group summaries for the first matching user's memberships.

Input Output Examples

Name	Type	Req	Description
limit	—	—	—
name	string	yes	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_list_groups ~152

List ZIdentity groups. Read-only. Returns lean group summaries (id, name, description, dynamic flag, source IdP) rather than the full SDK group record. Pass `name` for a case-insensitive partial-name filter.

Input Output Examples

Name	Type	Req	Description
exclude_dynamic_groups	—	—	—
limit	—	—	—
name	—	—	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_list_users ~174

List ZIdentity users. Read-only. Returns lean user summaries (id, login name, display name, primary email) rather than the full SDK user record. Pass any of the `*_name` / email filters for a case-insensitive partial match.

Input Output Examples

Name	Type	Req	Description
display_name	—	—	—
domain_name	—	—	—
idp_name	—	—	—
limit	—	—	—
login_name	—	—	—
offset	—	—	—
primary_email	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_search_groups ~141

Search ZIdentity groups by name (case-insensitive partial match). Read-only. Returns curated group summaries. An empty result means no group name contains this string — do not retry with split keywords or no filter.

Input Output Examples

Name	Type	Req	Description
limit	—	—	—
name	string	yes	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zid_search_users ~155

Search ZIdentity users by name, login name, or email. Read-only. Case-insensitive partial match. Values containing '@' match email; otherwise login name then display name are tried. An empty result means no user matches — do not retry with split keywords or no filter.

Input Output Examples

Name	Type	Req	Description
limit	—	—	—
name	string	yes	—
offset	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zins_get_casb_app_report ~184

Get the CASB (Cloud Access Security Broker) SaaS-application usage report. Read-only analytics. One row per SaaS application with its aggregated usage total, for seeing which cloud apps are being accessed. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_cyber_incidents ~193

Get cyber-security incidents grouped by category. Read-only analytics. Groups incidents by one or more dimensions (default THREAT_CATEGORY_ID); multi-dimension groupings surface their breakdown under nested `entries`. An empty result means no incidents were detected. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
categorize_by	—	—	—
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_cyber_incidents_by_location ~194

Get cyber-security incidents grouped by location (or app/user/department). Read-only analytics. One id/name/total row per location (or the chosen id-bearing dimension), useful for ranking which sites carry the most incidents. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
categorize_by	string	—	—
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_cyber_incidents_by_threat_and_app ~200

Get cyber-security incidents correlated by threat category and application. Read-only analytics. Groups by THREAT_CATEGORY_ID × APP_ID so each top-level threat-category bucket carries its per-application breakdown under nested `entries` — useful for finding the most-targeted apps. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_cyber_incidents_daily ~175

Get the daily cyber-security incident trend over time. Read-only analytics. Groups incidents by day (categorize_by=TIME) so you can spot spikes across the window. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_firewall_by_action ~172

Get Zero Trust Firewall traffic grouped by action (allow/block). Read-only analytics. One row per action with its aggregated total — the allowed-vs-blocked split. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_firewall_by_location ~172

Get Zero Trust Firewall traffic grouped by location. Read-only analytics. One id/name/total row per location, for ranking which sites drive the most firewall traffic. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_firewall_network_services ~167

Get Zero Trust Firewall traffic grouped by network service. Read-only analytics. One row per network service (protocol/port) with its aggregated total. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_iot_device_stats ~93

Get IoT device statistics and classifications. Read-only analytics. A single current-state object: total/IoT/user/server/unclassified device counts plus a per-classification breakdown under `entries`. No time window — this reflects the present network state. An empty/zeroed result means no IoT devices were detected or IoT Device Visibility is not enabled.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	—

No output schema declared.

No examples provided.

zins_get_shadow_it_apps ~190

Get discovered Shadow IT applications with risk and usage detail. Read-only analytics. One row per unsanctioned/discovered app: category, risk index, sanctioned state, data volume, and user count. An empty result means no shadow apps were detected. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_shadow_it_summary ~97

Get the aggregate Shadow IT summary dashboard. Read-only analytics. A single object with org-wide totals (apps, bytes, upload/download) plus breakdowns grouped by category and by risk index. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
start_days_ago	integer	—	—
start_time	—	—	—

No output schema declared.

No examples provided.

zins_get_threat_class ~188

Get threat-class distribution (Virus/Spyware, Advanced, Behavioral). Read-only analytics. One row per threat class with its aggregated total. An empty result means no threats of these classes were detected. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—
traffic_unit	string	—	—

No output schema declared.

No examples provided.

zins_get_threat_super_categories ~193

Get threat super-categories (malware, phishing, spyware, …) from web traffic. Read-only analytics. One row per threat super-category with its aggregated total. An empty result means no threats were detected in the window. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—
traffic_unit	string	—	—

No output schema declared.

No examples provided.

zins_get_web_protocols ~174

Get web traffic broken down by protocol (HTTP, HTTPS, SSL, …). Read-only analytics. One row per protocol with its aggregated total. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—
traffic_unit	string	—	—

No output schema declared.

No examples provided.

zins_get_web_traffic_by_location ~210

Get web traffic aggregated per location. Read-only analytics. Each row is a location with its total transactions or bytes; pass `include_trend=True` for the per-location time-series under `trend`. Window must be a 7- or 14-day historical interval (see the time-window inputs).

Input Output Examples

Name	Type	Req	Description
end_days_ago	integer	—	—
end_time	—	—	—
include_trend	boolean	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—
traffic_unit	string	—	—
trend_interval	—	—	—

No output schema declared.

No examples provided.

zins_get_web_traffic_no_grouping ~219

Get overall web traffic volume with no grouping. Read-only analytics. Returns total organization traffic, optionally filtered by DLP engine or action (ALLOW/BLOCK), and optionally with an overall time-series `trend`. Window must be a 7- or 14-day historical interval.

Input Output Examples

Name	Type	Req	Description
action_filter	—	—	—
dlp_engine_filter	—	—	—
end_days_ago	integer	—	—
end_time	—	—	—
include_trend	boolean	—	—
limit	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
start_days_ago	integer	—	—
start_time	—	—	—
traffic_unit	string	—	—
trend_interval	—	—	—

No output schema declared.

No examples provided.

zms_get_agent_connection_status_statistics ~55

Get ZMS agent connection-status statistics (curated aggregate view). Read-only. Returns connected vs disconnected counts / percentages for fleet health. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
search	—	—	—

No output schema declared.

No examples provided.

zms_get_agent_group_totp_secrets ~77

Get the TOTP secrets for a ZMS agent group (full record). Read-only API call, but the returned values ARE sensitive enrollment credentials — treat them like secrets. Keyed by `eyez_id`. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
eyez_id	string	yes	—

Name	Type	Req	Description
data	object	—	TOTP secret bundle (treat as sensitive credentials).
eyez_id	—	—	Agent group eyez_id (echoed).

No examples provided.

zms_get_agent_version_statistics ~59

Get ZMS agent version statistics (curated aggregate view). Read-only. Returns the distribution of agent software versions across the fleet — useful for spotting outdated agents. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
search	—	—	—

No output schema declared.

No examples provided.

zms_get_metadata ~45

Get ZMS resource event metadata (full record). Read-only. Returns metadata about the resource-level events available in the deployment. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
data	object	—	Aggregate payload (counts/percentages).

No examples provided.

zms_get_nonce ~57

Get one ZMS nonce. Read-only. Keyed by `eyez_id`. The payload may carry sensitive enrollment data — handle accordingly. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
eyez_id	string	yes	—

Name	Type	Req	Description
data	object	—	Full nonce payload.
eyez_id	—	—	Nonce eyez_id (echoed).

No examples provided.

zms_get_resource_group_members ~151

List the members of a ZMS resource group. Read-only. Returns one row per member workload. Obtain `group_id` from `zms_list_resource_groups`. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zms_get_resource_group_protection_status ~65

Get the ZMS resource-group protection-status summary (aggregate view). Read-only. Returns protected vs unprotected group counts and percentage. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
page_num	integer	—	—
page_size	integer	—	—

Name	Type	Req	Description
data	object	—	Aggregate payload (counts/percentages).

No examples provided.

zms_get_resource_protection_status ~75

Get the ZMS resource protection-status summary (curated aggregate view). Read-only. Returns protected vs unprotected counts and protection percentage — microsegmentation coverage at a glance. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
page_num	integer	—	—
page_size	integer	—	—

Name	Type	Req	Description
data	object	—	Aggregate payload (counts/percentages).

No examples provided.

zms_list_agent_groups ~158

List ZMS agent groups. Read-only. Returns one row per group (eyez_id, name, type, cloud provider, agent count, policy/tamper status). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
page	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—
sort	—	—	—
sort_dir	—	—	—

No output schema declared.

No examples provided.

zms_list_agents ~171

List ZMS microsegmentation agents. Read-only. Returns one row per agent (eyez_id, name, connection status, version, OS, IP). Requires ZSCALER_CUSTOMER_ID. Use a returned `eyez_id` with the agent-group / nonce tools.

Input Output Examples

Name	Type	Req	Description
page	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—
sort	—	—	—
sort_dir	—	—	—

No output schema declared.

No examples provided.

zms_list_app_catalog ~179

List the ZMS application catalog. Read-only. Returns one row per discovered application (id, name, category) plus its nested port/protocol/process specs — useful for policy planning. Filter by name/category, sort by name/category/time. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
category	—	—	—
name	—	—	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
sort_by	—	—	—
sort_order	—	—	—

No output schema declared.

No examples provided.

zms_list_app_zones ~146

List ZMS app zones. Read-only. Returns one row per app zone (id, name, description, resource count). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
name	—	—	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
sort_order	—	—	—

No output schema declared.

No examples provided.

zms_list_default_policy_rules ~131

List ZMS default policy rules. Read-only. The built-in default rules evaluated when no custom rule matches. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zms_list_nonces ~149

List ZMS enrollment nonces. Read-only. Returns one row per nonce (eyez_id, name, status, expiry). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
page	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
search	—	—	—
sort	—	—	—
sort_dir	—	—	—

No output schema declared.

No examples provided.

zms_list_policy_rules ~171

List ZMS microsegmentation policy rules. Read-only. Returns one row per rule (id, name, action, priority, enabled). Filter by name/action. `fetch_all` bypasses pagination — use sparingly. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
action	—	—	—
fetch_all	boolean	—	—
name	—	—	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

No output schema declared.

No examples provided.

zms_list_resource_groups ~160

List ZMS resource groups. Read-only. Returns one row per group (id, name, managed/unmanaged type, origin, member count, and CIDRs/FQDNs for unmanaged groups). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
name	—	—	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
resource_hostname	—	—	—

No output schema declared.

No examples provided.

zms_list_resources ~202

List ZMS resources (workloads). Read-only. Returns one row per workload (id, name, type, status, cloud provider/region, OS, IPs). Filter by name/status/type/provider/region/OS. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
cloud_provider	—	—	—
cloud_region	—	—	—
include_deleted	boolean	—	—
name	—	—	—
page_num	integer	—	—
page_size	integer	—	—
platform_os	—	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
resource_type	—	—	—
sort_order	—	—	—
status	—	—	—

No output schema declared.

No examples provided.

zms_list_tag_keys ~174

List ZMS tag keys within a namespace. Read-only. Middle of the tag hierarchy. Returns one row per key (id, key_name, value count). Obtain `namespace_id` from `zms_list_tag_namespaces`. Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
key_name	—	—	—
namespace_id	string	yes	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
sort_order	—	—	—

No output schema declared.

No examples provided.

zms_list_tag_namespaces ~162

List ZMS tag namespaces. Read-only. Top of the tag hierarchy (namespace -> key -> value). Returns one row per namespace (id, name, origin, key count). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
name	—	—	—
origin	—	—	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
sort_order	—	—	—

No output schema declared.

No examples provided.

zms_list_tag_values ~194

List ZMS tag values for a key. Read-only. Bottom of the tag hierarchy. Returns one row per value (id, name). Needs the `tag_id` (from `zms_list_tag_keys`) and the `namespace_origin` (CUSTOM / EXTERNAL / ML / UNKNOWN). Requires ZSCALER_CUSTOMER_ID.

Input Output Examples

Name	Type	Req	Description
name	—	—	—
namespace_origin	string	yes	—
page_num	integer	—	—
page_size	integer	—	—
query	—	—	Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
sort_order	—	—	—
tag_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_access_policy_rule ~38

Get one ZPA access policy rule (read-only).

Input Output Examples

Name	Type	Req	Description
microtenant_id	—	—	—
rule_id	string	yes	—

No output schema declared.

No examples provided.

zpa_get_app_connector ~38

Get one ZPA app connector by ID (read-only).

Input Output Examples

Name	Type	Req	Description
connector_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

zpa_get_app_connector_group ~38

Get one ZPA app connector group (read-only).

Input Output Examples

Name	Type	Req	Description
group_id	string	yes	—
microtenant_id	—	—	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	11
27 Jul	42
28 Jul	42
29 Jul	42
30 Jul	42
31 Jul	38
1 Aug	38
2 Aug	38
3 Aug	38